Renovate: Summary of updates contained in PR is inaccurate

[frangio]

What Renovate type, platform and version are you using?

Hosted GitHub App

Describe the bug

A Renovatebot PR of grouped npm dependencies contains a summary of what's being updated. Upon inspection, some of the entries in the table are actually not present in the PR's diff of the lockfile. (Note that I'm using "rangeStrategy": "update-lockfile".)

Relevant debug logs

Everything in the logs looks "fine" to me.

yarn command log entry

(branch="renovate/all-minor-patch")
{
  "command": "docker run --rm --name=renovate_node --label=renovate_child -v \"/mnt/renovate/gh/OpenZeppelin/openzeppelin-upgrades\":\"/mnt/renovate/gh/OpenZeppelin/openzeppelin-upgrades\" -v \"/tmp/renovate-cache\":\"/tmp/renovate-cache\" -v \"/home/ubuntu/.npmrc\":\"/home/ubuntu/.npmrc\" -e NPM_CONFIG_CACHE -e npm_config_store -e CI -w \"/mnt/renovate/gh/OpenZeppelin/openzeppelin-upgrades\" docker.io/renovate/node bash -l -c \"npm i -g yarn && sed -i 's/ steps,/ steps.slice(0,1),/' /home/ubuntu/.npm-global/lib/node_modules/yarn/lib/cli.js && yarn install --ignore-engines --ignore-platform --network-timeout 100000 --ignore-scripts && yarn upgrade @nomiclabs/buidler @nomiclabs/buidler @openzeppelin/contracts @truffle/contract @types/node eslint ethereumjs-util ethers solidity-ast solidity-ast --ignore-engines --ignore-platform --network-timeout 100000 --ignore-scripts\""
}
DEBUG: exec completed(branch="renovate/all-minor-patch")
{
  "cmd": "docker run --rm --name=renovate_node --label=renovate_child -v \"/mnt/renovate/gh/OpenZeppelin/openzeppelin-upgrades\":\"/mnt/renovate/gh/OpenZeppelin/openzeppelin-upgrades\" -v \"/tmp/renovate-cache\":\"/tmp/renovate-cache\" -v \"/home/ubuntu/.npmrc\":\"/home/ubuntu/.npmrc\" -e NPM_CONFIG_CACHE -e npm_config_store -e CI -w \"/mnt/renovate/gh/OpenZeppelin/openzeppelin-upgrades\" docker.io/renovate/node bash -l -c \"npm i -g yarn && sed -i 's/ steps,/ steps.slice(0,1),/' /home/ubuntu/.npm-global/lib/node_modules/yarn/lib/cli.js && yarn install --ignore-engines --ignore-platform --network-timeout 100000 --ignore-scripts && yarn upgrade @nomiclabs/buidler @nomiclabs/buidler @openzeppelin/contracts @truffle/contract @types/node eslint ethereumjs-util ethers solidity-ast solidity-ast --ignore-engines --ignore-platform --network-timeout 100000 --ignore-scripts\"",
  "durationMs": 17988,
  "stdout": "/home/ubuntu/.npm-global/bin/yarn -> /home/ubuntu/.npm-global/lib/node_modules/yarn/bin/yarn.js\n/home/ubuntu/.npm-global/bin/yarnpkg -> /home/ubuntu/.npm-global/lib/node_modules/yarn/bin/yarn.js\n+ [email protected]\nadded 1 package in 0.977s\nyarn install v1.22.5\n[1/4] Resolving packages...\nDone in 4.39s.\nyarn upgrade v1.22.5\n[1/4] Resolving packages...\nsuccess Saved lockfile.\nsuccess Saved 40 new dependencies.\ninfo Direct dependencies\n└─ [email protected]\ninfo All dependencies\n├─ @babel/[email protected]\n├─ @eslint/[email protected]\n├─ @types/[email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n├─ [email protected]\n└─ [email protected]\nDone in 6.86s.\n",
  "stderr": ""
}

To Reproduce

See https://github.com/OpenZeppelin/openzeppelin-upgrades/pull/166. For example, see @types/node.

[rarkins]

Please see if you can reproduce it in a separate repo that is ready for forking/testing.

[frangio]

Is there an issue with the repository I linked? I can clone it to a repo where master points to the commit that presents this issue if that helps. I don't have time to try to reduce it to a minimal repo that reproduces it.

[JamieMagee]

Yeah, I think the ask was for a minimal repo. We can work with the one you shared, but it's not optimal for debugging.

[rarkins]

Let's just keep it on low priority until it's important enough to a user to create a minimal reproduction for.

[frangio]

That's fine. I hope my comment didn't come off as entitled. I would like to provide a minimal repro, but I thought it was best to submit the report even if I don't have time to put it together yet.